CVE-2025-14290 is a server-side request forgery (SSRF) vulnerability in IBM webMethods Integration Server (on-premises) versions 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10. An authenticated attacker can exploit this vulnerability to send unauthorized requests from the server, potentially enabling network enumeration or other follow-on attacks. The vulnerability is classified under CWE-918 and has a CVSS v3.1 base score of 5.4, indicating medium severity. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on IBM's future guidance.

The vulnerability allows an authenticated attacker to perform SSRF attacks, which can lead to unauthorized internal network requests. This may enable network reconnaissance or facilitate additional attacks within the network environment. The confidentiality and integrity impacts are low, and availability is not affected. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor IBM's advisories for updates. Until a patch is available, restrict authenticated user access to trusted personnel only and consider network-level controls to limit outbound requests from the Integration Server where feasible.